As mentioned in the introduction, packages are compiled from the ports tree. In this section we will explain how the ports tree works, when you should use it and how you can use it.

IMPORTANT NOTE: The ports tree is meant for advanced users. Everyone
is encouraged to use the pre-compiled binary packages.

Second: Everything from packages and (especially) ports is considered 3rd party. The OpenBSD developers do not "support" packages or ports - the community does. As far as the OpenBSD project is concerned you are on your own with packages and ports... they're not really part of the OpenBSD project. This means that if they don't go through the normal auditing process or receive security updates through the OpenBSD projects - again they are community supported.

Third: There is no host-based virtualization platform included in OpenBSD that I am aware of (well there's the Linux binary compatibility layer - but that's a fancy kernel land API trick), nor do I ever expect this functionality to be added to OpenBSD. The OpenBSD project has infamously been pretty loathe to adopt virtualization:

"x86 virtualization is about basically placing another nearly full
kernel, full of new bugs, on top of a nasty x86 architecture which
barely has correct page protection. Then running your operating system
on the other side of this brand new pile of shit. You are absolutely
deluded, if not stupid, if you think that a worldwide collection of
software engineers who can't write operating systems or applications
without security holes, can then turn around and suddenly write
virtualization layers without security holes."

I'm searching for one that doesn't use packages from ports. Are there any?

No. And there probably never will be. OpenBSD is a fantastic operating system, but it is not a good choice as virtualization host.

If you still want/need to use OpenBSD as a virtualization host, I think QEMU is your only option. It is available as both a package and from the ports tree.